ELK安装部署(Elasticsearch，Logstash，Kibana)

---

ELK安装

---

• 准备两台centos7
• 配置：2核心2G内存
• 规划如下：
  1）：A机上安装jdk，kibana，elasticsearch
  2）：B机上安装jdk，logstash

A,B机同做安装jdk

1).关闭防火墙

[root@localhost src]# systemctl stop firewalld
[root@localhost src]# setenforce 0

2).时间同步

[root@localhost src]# yum -y install ntpdate
[root@localhost src]# ntpdate  pool.ntp.org

3).安装jdk

[root@localhost ELK]# rpm -ivh jdk-8u131-linux-x64_.rpm 
验证：
[root@localhost ELK]# java -version

A机上安装elasticsearch
1.安装elasticsearch

[root@localhost ELK]# rpm -ivh elasticsearch-6.6.2.rpm

修改配置文件：

vim /etc/elasticsearch

[root@localhost elasticsearch]# cat elasticsearch.yml
|grep -v "^#"
cluster.name: huazai007
node.name: node-1
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
network.host: 192.168.10.130
http.port: 9200

2.运行es服务：

systemctl enable elasticsearch
systemctl start elasticsearch

验证服务是否正常运行：

[root@localhost elasticsearch]# tailf/var/log/elasticsearch/huazai007.log

B机上做logstash
1.安装logstash

[root@localhost ELK]# rpm -ivh logstash-6.6.0.rpm

2.收集/var/log/messages日志

vim /etc/logstash/conf.d

[root@localhost conf.d]# cat msg.conf 
input{
         file{
                  path=> "/var/log/messages"
                  type=> 'msg-log'
                  start_position=> "beginning"
         }
} 
output{
         elasticsearch{
                  hosts=> "192.168.10.130:9200"
                  index=> "msg_log-%{+YYYY.MM.dd}"
         }
}

收集secure日志，编辑secure.conf

[root@localhost logstash]# cat /etc/logstash/conf.d/secure.conf 
input{
         file{
                  path=> "/var/log/secure"
                  type=> 'sec-log'
                  start_position=> "beginning"
         }
} 
output{
         elasticsearch{
                  hosts=> "192.168.10.130:9200"
                  index=> "sec_log-%{+YYYY.MM.dd}"
         }
}

3.启动服务

[root@localhost conf.d]# systemctl start logstash

验证端口：

[root@localhost conf.d]# netstat  -lptnu|grep 9600
tcp6      
0      0 127.0.0.1:9600          :::*                    LISTEN      13879/java 

再次返回A机安装kibana
1.安装kibana

[root@localhost ELK]# rpm -ivh kibana-6.6.2-x86_64.rpm

进入kibana，编辑kibana配置文件

[root@localhost kibana]# cat kibana.yml |grep -v '^#'|sed '/^$/d'
server.port: 5601
server.host: "192.168.10.130"
elasticsearch.hosts:["http://192.168.10.130:9200"]

启动并查看端口：

[root@localhost kibana]# systemctl start kibana
[root@localhost kibana]# netstat  -lptnu|grep 5601
tcp        0     0 192.168.10.130:5601     0.0.0.0:*              LISTEN      16590/node    

再次回B机上编辑pipeline.yaml配置文件

vim pipeline.yaml

- pipeline.id: msg 
path.config: "/etc/logstash/conf.d/msg.conf"
- pipeline.id: sec 
path.config: "/etc/logstash/conf.d/secure.conf"

报错处理（B上执行）
chmod 644 /var/log/messages
systemctl status logstash